Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 05:17
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe
Resource
win10v2004-20240226-en
General
-
Target
SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe
-
Size
6.9MB
-
MD5
7a96de0c5f4d55fc51aab6b3eceb6644
-
SHA1
032d36e9d5ec19eaab2a36d85d5650a1dfa97865
-
SHA256
447832ebee40568a2f46d9fa452d5412d4f065149db1a2a8d1760023e51ac431
-
SHA512
e22e236f35ee9623d1a63545ab9925efdc44e5ce3aea7ae5f59440f072d84d6922d05b79436df6a6acec53e34f62c9421d34bfecf9dc3988e977399970c777a2
-
SSDEEP
196608:thFgtxwuLlA1HeT39IigJ1ncKOVVtk7cZtQrNP+P:wqr1+TtIi00VQa6M
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2952 SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2952 2904 SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe 28 PID 2904 wrote to memory of 2952 2904 SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe 28 PID 2904 wrote to memory of 2952 2904 SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.SpywareX-gen.1297.32391.exe"2⤵
- Loads dropped DLL
PID:2952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5d521654d889666a0bc753320f071ef60
SHA15fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA25621700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
SHA5127a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3